Microsoft Tracks MacSync Stealer by Its Behavior, Not Its Domains

Microsoft tracked a macOS information stealer called MacSync Stealer not by blocking domains but by correlating persistent behavioral patterns: terminal-based social engineering (ClickFix), curl downloads from /curl/[token], AppleScript-driven execution, staging/compression of stolen data under /tmp/sync*, and chunked HTTP PUT uploads with upload_id/chunk_index/total_chunks. The behavior-led approach linked over 30 domains, revealed static API-key reuse across some C2s, and emphasizes building detections around the attack sequence rather than ephemeral domain lists.